Skip to main content
dpdprules.org
Data breached?
☰

Sources last verified on 17 August 2026. Methodology

DPDP Rules 2025 · Rule 13

Additional obligations of Significant Data Fiduciary

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (Publication date 13 November 2025 printed on Gazette issue No. 760, plus eighteen months. The corrigendum wording change does not affect this computation.)
Source
Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) · G.S.R. 846(E) · Gazette page 29
Last verified
17 August 2026

Corrected by corrigenda G.S.R. 892(E)

  • For “Department” read “Departments” (page 29, line 44)

The text below shows the corrected wording.

Official requirement · verbatim

Rule 13. Additional obligations of Significant Data Fiduciary.(1) A Significant Data Fiduciary shall, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder. (2) A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations in the Data Protection Impact Assessment and audit. (3) A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals. (4) A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India. (5) In this rule, “committee” means a committee constituted by the Central Government for the purpose of this rule, which shall include officials from the Ministry of Electronics and Technology and may include officials from other Ministries or Departments of the Central Government.

Show the text as originally printed, before corrigendum

(1) A Significant Data Fiduciary shall, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder. (2) A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations in the Data Protection Impact Assessment and audit. (3) A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals. (4) A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India. (5) In this rule, “committee” means a committee constituted by the Central Government for the purpose of this rule, which shall include officials from the Ministry of Electronics and Technology and may include officials from other Ministries or Department of the Central Government.

Commencement basis · Rules 3, 5 to 16, 22 and 23

“Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.”

Wording as corrected by corrigenda G.S.R. 892(E).

Sources cited on this page

  1. [1]Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, p. 29. Published 13 November 2025. Official source ↗ · Official requirement · Verified 17 August 2026The printed text reads "Ministry of Electronics and Technology" in sub rule (5); the corrigendum does not correct that phrase, so it is reproduced as printed.
  2. [2]Corrigenda to the Digital Personal Data Protection Rules, 2025 (G.S.R. 892(E)), (ii), p. 1. Published 11 December 2025. Official source ↗ · Official requirement · Verified 16 August 2026Corrigendum item (ii) corrects "Department" to "Departments" at Gazette page 29 line 44.
  3. [3]Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ · Official requirement · Verified 16 August 2026As printed. Corrigenda G.S.R. 892(E) item (i)(b) corrects the closing words to read in the Official Gazette; the computation is unaffected.
  4. [4]Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), p. 1. Published 13 November 2025. Official source ↗ · Interpretation, requires judgment · Verified 16 August 2026The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed.
  5. [5]Corrigenda to the Digital Personal Data Protection Rules, 2025 (G.S.R. 892(E)), (ii), p. 1. Published 11 December 2025. Official source ↗ · Official requirement · Verified 16 August 2026